X-Radius
العربية Try it free
Try it free

Public reference

Users

Every endpoint in this group. Open one for its parameters and a worked example.

92 Endpoints

View as Markdown

Users

92
GET /api/v1/users List subscribers prm_users_index

One page of subscribers under the caller's authority. A manager without tenant-wide visibility sees only subscribers owned by their own manager subtree, and that scope is injected server-side, so a filter can narrow within it but never widen past it.

Authentication
Staff token or session
Requires permission
prm_users_index View users
Rate limit
user_list

The per-subscriber scan token (lookup_token) is deliberately absent from list rows. It is served by GET /users/{id} and GET /users/resolve only, because a page of a thousand rows is a bulk harvest of codes that each unlock a subscriber record.

Parameters

Parameter Description
q query · string Searches username, email, first and last name, phone, contract id, national id and static IP. A purely numeric term also matches the subscriber id exactly.
filter[enabled] query · boolean The admin suspend flag. Not the same thing as expired.
filter[expired] query · boolean Subscription window has passed.
filter[online] query · boolean An open RADIUS session exists right now.
filter[profile_id] query · integer Bound plan.
filter[parent_id] query · integer Owning manager. Ignored, not honoured, when it would widen a restricted caller's scope.
filter[username_exact] query · string Case-insensitive exact username, for a caller that already knows the identity and wants one deterministic row instead of a page of substring hits.
filter[expiring_within_days] query · integer Future expiries only.
filter[created_from] query · string yyyy-MM-dd HH:mm:ss in UTC. A malformed value is a 400, not an ignored filter.

Open the full reference

Response 200 OK 
{
  "data": [
    {
      "id": 4711,
      "tenant_id": 12,
      "username": "ahmed",
      "email": "ahmed@example.test",
      "enabled": true,
      "status": {
        "enabled": true,
        "deleted": false,
        "online": true,
        "expired": false,
        "have_quota": true,
        "fup": false,
        "can_connect": true
      },
      "profile_id": 7,
      "profile_name": "Home 20M",
      "parent_id": 41,
      "parent_username": "cairo-reseller",
      "bytes_remaining": 48318382080,
      "plan_bytes_limit": 107374182400,
      "used_bytes": 59055800320,
      "expiration": "2026-10-14 00:00:00",
      "balance": 0.00,
      "debt": 0.00,
      "mac_lock_enabled": false,
      "mac_locked_addrs": [],
      "enforces_bytes": true,
      "enforces_seconds": false,
      "created_at": "2026-03-02 11:40:12"
    }
  ],
  "meta": { "page": 1, "page_size": 50, "total": 812, "has_next": true }
}
POST /api/v1/users Create a subscriber prm_users_create

Creates the account and its identity only. It does not activate a plan, take money or grant quota — binding profile_id here is metadata. Use the activation endpoint for the paid part.

Authentication
Staff token or session
Requires permission
prm_users_create Create users
Rate limit
t_mutate

debt_limit is tri-state and the two falsy values mean opposite things. Omitted or null is unlimited credit; 0 is no credit at all. Sending 0 to mean "no opinion" silently blocks every future debit.

Parameters

Parameter Description
usernamerequired body · string Unique within the tenant, not globally.
passwordrequired body · string The RADIUS password. Stored recoverable, because CHAP and MS-CHAPv2 need it that way.
parent_id body · integer Owning manager. Defaults to the caller. A subscriber is never parent-less, and a named owner must be a manager the caller may act on.
profile_id body · integer Plan to bind. Must be one the acting manager may actually assign.
expiration body · string yyyy-MM-dd HH:mm:ss in UTC.
debt_limit body · number Credit ceiling. Omitted or null is unlimited, 0 is no credit.
portal_password body · string Optional portal-only password, hashed before storage and distinct from the RADIUS password above.
custom_fields body · object Tenant-defined form values, validated against the user form schema.

Open the full reference

Response 201 Created 
{
  "data": {
    "id": 4712,
    "tenant_id": 12,
    "username": "ahmed",
    "enabled": true,
    "profile_id": 7,
    "parent_id": 41,
    "balance": 0.00,
    "debt": 0.00,
    "created_at": "2026-09-20 09:14:55"
  }
}
POST /api/v1/users/bulk-add-days Extend subscription prm_users_extend
Authentication
Staff token or session
Requires permission
prm_users_extend Extend subscription
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/bulk-add-hours Extend subscription prm_users_extend
Authentication
Staff token or session
Requires permission
prm_users_extend Extend subscription
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/bulk-add-traffic Add traffic prm_users_add_traffic
Authentication
Staff token or session
Requires permission
prm_users_add_traffic Add traffic
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/bulk-delete Delete users prm_users_delete
Authentication
Staff token or session
Requires permission
prm_users_delete Delete users
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/bulk-deposit Deposit to user wallet prm_users_deposit
Authentication
Staff token or session
Requires permission
prm_users_deposit Deposit to user wallet
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/bulk-deposit/preview Deposit to user wallet prm_users_deposit
Authentication
Staff token or session
Requires permission
prm_users_deposit Deposit to user wallet
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/bulk-disable Suspend many subscribers prm_users_enable_disable

Takes an array of ids and suspends each. One request against the per-tenant write budget instead of one per subscriber, which is the difference between fitting in a minute and not.

Authentication
Staff token or session
Requires permission
prm_users_enable_disable Enable / suspend users
Rate limit
t_mutate

A bulk call reports per-id outcomes and returns 200 even when some ids failed. failed is always present, as an array, and each entry carries a stable reason (not_found, not_authorized, error) alongside a localized message. Branch on reason; treating the 200 as "all of them worked" is the mistake this shape exists to prevent.

Parameters

Parameter Description
idsrequired body · array Subscriber ids.

Open the full reference

Response 200 OK 
{
  "data": {
    "updated": [4711, 4713],
    "failed": [
      { "id": 4712, "reason": "not_authorized", "message": "You may not act on this record." }
    ]
  }
}
POST /api/v1/users/bulk-disconnect Live traffic / disconnect prm_users_live_traffic
Authentication
Staff token or session
Requires permission
prm_users_live_traffic Live traffic / disconnect
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/bulk-enable Enable / suspend users prm_users_enable_disable
Authentication
Staff token or session
Requires permission
prm_users_enable_disable Enable / suspend users
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/bulk-extend
Authentication
Staff token or session
Requires any one of
prm_users_activate prm_users_extend
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/bulk-extend/preview
Authentication
Staff token or session
Requires any one of
prm_users_activate prm_users_extend
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/bulk-reset-balance Withdraw / settle user debt prm_users_withdrawal
Authentication
Staff token or session
Requires permission
prm_users_withdrawal Withdraw / settle user debt
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/bulk-reset-quota Reset user quota prm_users_reset_quota
Authentication
Staff token or session
Requires permission
prm_users_reset_quota Reset user quota
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/bulk-set-expiration Extend subscription prm_users_extend
Authentication
Staff token or session
Requires permission
prm_users_extend Extend subscription
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/bulk-set-group Assign groups prm_groups_assign
Authentication
Staff token or session
Requires permission
prm_groups_assign Assign groups
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/bulk-set-parent Change user parent prm_users_change_parent
Authentication
Staff token or session
Requires permission
prm_users_change_parent Change user parent
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/bulk-set-profile Change user profile prm_users_change_profile
Authentication
Staff token or session
Requires permission
prm_users_change_profile Change user profile
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/bulk-withdraw Withdraw / settle user debt prm_users_withdrawal
Authentication
Staff token or session
Requires permission
prm_users_withdrawal Withdraw / settle user debt
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/bulk-withdraw/preview Withdraw / settle user debt prm_users_withdrawal
Authentication
Staff token or session
Requires permission
prm_users_withdrawal Withdraw / settle user debt
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

GET /api/v1/users/owner-context Create users prm_users_create
Authentication
Staff token or session
Requires permission
prm_users_create Create users

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

GET /api/v1/users/resolve Resolve a subscriber by scan code prm_users_index

Exchanges the opaque per-subscriber scan token, the one encoded in a printed QR code, for the subscriber record. Scoped to the caller's subtree exactly like a direct fetch.

Authentication
Staff token or session
Requires permission
prm_users_index View users
Rate limit
user_resolve

Parameters

Parameter Description
coderequired query · string The scan token. The QR payload is prefixed with xr:u: — strip the prefix before sending.

Open the full reference

GET /api/v1/users/summary Count subscribers by state prm_users_index

Fleet-health counters over exactly the same authority scope as the list, so a count and the rows behind it always agree.

Authentication
Staff token or session
Requires permission
prm_users_index View users

active means enabled AND not expired, not the bare enabled flag. total is every non-deleted subscriber, so the four other counters do not sum to it.

Open the full reference

Response 200 OK 
{
  "data": {
    "total": 812,
    "active": 640,
    "disabled": 44,
    "online": 318,
    "expired": 128
  }
}
DELETE /api/v1/users/{id} Delete a subscriber prm_users_delete

Soft-deletes the account and frees its username slot by renaming the row. The subscriber's live portal sessions are ended.

Authentication
Staff token or session
Requires permission
prm_users_delete Delete users
Rate limit
t_mutate

Parameters

Parameter Description
idrequired path · integer Subscriber id.

Open the full reference

GET /api/v1/users/{id} Fetch one subscriber prm_users_index

The full record, including the computed status object and the fields the list projection leaves out.

Authentication
Staff token or session
Requires permission
prm_users_index View users

A subscriber that exists but sits outside your subtree returns the same 404 as one that does not exist, byte for byte including details.reason. That is deliberate: a 403 would confirm the id and make the id space enumerable.

Parameters

Parameter Description
idrequired path · integer Subscriber id.

Open the full reference

Response 200 OK 
{
  "data": {
    "id": 4711,
    "tenant_id": 12,
    "username": "ahmed",
    "enabled": true,
    "status": { "online": true, "expired": false, "have_quota": true, "can_connect": true },
    "profile_id": 7,
    "fup_profile_id": null,
    "bytes_remaining": 48318382080,
    "seconds_remaining": null,
    "expiration": "2026-10-14 00:00:00",
    "balance": 0.00,
    "debt": 0.00,
    "debt_limit": null,
    "mac_lock_enabled": false,
    "mac_locked_addrs": [],
    "simultaneous_sessions": 1,
    "allowed_services": "both",
    "lookup_token": "n8Qk2vRa1pLd7WxYzB0cEf",
    "custom_fields": {},
    "created_at": "2026-03-02 11:40:12"
  }
}
PATCH /api/v1/users/{id} Update a subscriber prm_users_update

Partial update. An omitted field is left alone. Three fields are separately permission-gated and are dropped silently rather than refused when the caller lacks the right: parent_id, profile_id and expiration.

Authentication
Staff token or session
Requires permission
prm_users_update Edit users
Rate limit
t_mutate

A stored mac_locked_addrs list is inert until mac_lock_enabled is true. Writing the list alone locks nothing, which reads on screen like the lock silently failed. Set both.

Parameters

Parameter Description
idrequired path · integer Subscriber id.
form_name body · string Which custom-field schema to validate custom_fields against. Defaults to the user form.

Open the full reference

POST /api/v1/users/{id}/activate Un-suspend a subscriber prm_users_enable_disable

Sets enabled back to true. This is the inverse of suspend and has nothing to do with activating a plan — that is the activation endpoint, which charges money.

Authentication
Staff token or session
Requires permission
prm_users_enable_disable Enable / suspend users
Rate limit
t_mutate

The name is a historical trap. This endpoint lifts a suspension and takes no money. POST /users/{id}/activation is the one that prices, charges and provisions a plan.

Parameters

Parameter Description
idrequired path · integer Subscriber id.

Open the full reference

POST /api/v1/users/{id}/activation Charge and provision an activation

Prices, charges and provisions in one operation. Funds are reserved first, then the plan is applied, and both halves are keyed off your request_id, so a retry after a crash re-runs neither the charge nor the grant.

Authentication
Staff token or session
Requires any one of
prm_users_activate prm_users_extend
Rate limit
t_mutate
Idempotency key
request_id

The nested activation object is serialised with Go field names (UserID, NewSubscriptionEnd) and RFC3339 timestamps, unlike every other object on this API. Everything around it uses snake_case and yyyy-MM-dd HH:mm:ss. Do not write a parser that assumes one convention.

Parameters

Parameter Description
idrequired path · integer Subscriber id.
request_idrequired body · string Idempotency key, up to 255 characters, no colon or pipe. Reuse the same one on every retry of one intent.
money_collected body · boolean Defaults to true.
card_code body · string Required when method is card. The voucher must be in the caller's subtree.
issue_invoice body · boolean Also record an invoice document. Skipped on a replay so a retry never double-issues.

Open the full reference

Response 200 OK 
{
  "data": {
    "quote": { "profile_id": 7, "required_amount": 171.00, "new_expiration": "2026-10-14 00:00:00" },
    "activation": {
      "UserID": 4711,
      "ProfileID": 7,
      "NewSubscriptionEnd": "2026-10-14T00:00:00Z",
      "BytesRemaining": 107374182400,
      "SecondsRemaining": -1,
      "PointsAwarded": 10,
      "QuotaCarried": false,
      "Replay": false
    },
    "manager_balance": 4029.00,
    "replay": false
  }
}
POST /api/v1/users/{id}/activation-quote Price an activation or extension

Read-only preview of what an activation would cost and grant: unit price, VAT, the computed new expiration, the plan's quota, both wallets, reward points and whether the chosen method can cover it. Writes nothing, so it is safe to call on every keystroke of a form.

Authentication
Staff token or session
Requires any one of
prm_users_activate prm_users_extend
Rate limit
t_mutate

A quota figure of -1 means unlimited, and 0 means none. They are not interchangeable and the difference is load-bearing on the RADIUS gate. Read uptime_seconds -1 above as "no time cap on this plan", not "no time left".

Parameters

Parameter Description
idrequired path · integer Subscriber id.
profile_id body · integer Plan to price. Defaults to the subscriber's current plan.
operation body · enum activate or extend. Defaults to activate.
method body · enum manager_balance, user_balance, reward_points or card.
units body · integer How many periods to buy.
user_price body · number Retail price override. Silently ignored for a caller without the price-override permission, which then falls back to the plan or pricing-tree price.

Open the full reference

Response 200 OK 
{
  "data": {
    "user_id": 4711,
    "username": "ahmed",
    "profile_id": 7,
    "profile_name": "Home 20M",
    "operation": "activate",
    "method": "manager_balance",
    "units": 1,
    "unit_price": 150.00,
    "end_user_price": 180.00,
    "vat_percent": 14.00,
    "vat_amount": 21.00,
    "required_amount": 171.00,
    "price_overridden": false,
    "duration_value": 30,
    "duration_unit": "days",
    "total_bytes": 107374182400,
    "uptime_seconds": -1,
    "old_expiration": "2026-09-14 00:00:00",
    "new_expiration": "2026-10-14 00:00:00",
    "manager_balance": 4200.00,
    "manager_available": 4200.00,
    "user_balance": 0.00,
    "points_awarded": 10,
    "can_afford": true,
    "warnings": [],
    "debitable": false
  }
}
POST /api/v1/users/{id}/add-traffic Grant quota directly prm_users_add_traffic

Adds bytes and/or seconds to the subscriber's remaining period quota without pricing or charging anything, and drops the hot-path quota cache so the grant applies on the next RADIUS request.

Authentication
Staff token or session
Requires permission
prm_users_add_traffic Add traffic
Rate limit
t_mutate

request_id is accepted here for your own tracing but is not enforced, because adding traffic is not naturally idempotent. Two calls add twice. Do not build a retry loop on this endpoint the way you would on deposit.

Parameters

Parameter Description
idrequired path · integer Subscriber id.
bytes body · integer Bytes to add. At least one of bytes or seconds must be present and positive.
seconds body · integer Seconds to add.

Open the full reference

POST /api/v1/users/{id}/addon-quote Sell add-ons prm_users_addon
Authentication
Staff token or session
Requires permission
prm_users_addon Sell add-ons
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/addons Sell add-ons prm_users_addon
Authentication
Staff token or session
Requires permission
prm_users_addon Sell add-ons
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/approve Approve pending signups prm_users_approve_signup
Authentication
Staff token or session
Requires permission
prm_users_approve_signup Approve pending signups
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/assign-profile Edit users prm_users_update
Authentication
Staff token or session
Requires permission
prm_users_update Edit users
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

PUT /api/v1/users/{id}/bucket-order Set the bucket drain order prm_users_buckets

Replaces the subscriber's custom drain order. Every id must be one of their active buckets, except the sentinel 0, which stands for the plan's own main quota and may be placed anywhere in the sequence.

Authentication
Staff token or session
Requires permission
prm_users_buckets Manage quota buckets
Rate limit
t_mutate

The 0 in that array is meaningful and positional. It is the main plan quota, so stripping non-positive ids as "empty" would silently reorder the drain sequence rather than reject it.

Parameters

Parameter Description
idrequired path · integer Subscriber id.
orderrequired body · array Bucket ids in drain order. 0 is the main quota, not a missing value.

Open the full reference

POST /api/v1/users/{id}/cancel-service Cancel service prm_users_cancel
Authentication
Staff token or session
Requires permission
prm_users_cancel Cancel service
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/change-parent Move a subscriber to another owner prm_users_change_parent

Re-points the subscriber at a different owning manager. The destination must be a manager the caller may act on, because the owner is both the creditor on a debt and the revenue attribution. Naturally idempotent, so request_id is accepted for your own tracing but is not enforced.

Authentication
Staff token or session
Requires permission
prm_users_change_parent Change user parent
Rate limit
t_mutate

Parameters

Parameter Description
idrequired path · integer Subscriber id.
parent_idrequired body · integer The new owning manager.

Open the full reference

POST /api/v1/users/{id}/change-profile Change user profile prm_users_change_profile
Authentication
Staff token or session
Requires permission
prm_users_change_profile Change user profile
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/compensate Compensate users prm_users_compensate
Authentication
Staff token or session
Requires permission
prm_users_compensate Compensate users
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/compensations/{reqId}/approve Approve/reject compensation requests prm_users_compensate_approve
Authentication
Staff token or session
Requires permission
prm_users_compensate_approve Approve/reject compensation requests
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/compensations/{reqId}/reject Approve/reject compensation requests prm_users_compensate_approve
Authentication
Staff token or session
Requires permission
prm_users_compensate_approve Approve/reject compensation requests
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/cpe-console Remote access to user's CPE (router admin UI) prm_users_remote
Authentication
Staff token or session
Requires permission
prm_users_remote Remote access to user's CPE (router admin UI)
Rate limit
t_probe

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

GET /api/v1/users/{id}/debt Read a subscriber's debt prm_users_index

Total outstanding debt across all creditors, plus the slice of it owed to the calling manager specifically, read live off the loan ledger.

Authentication
Staff token or session
Requires permission
prm_users_index View users

Parameters

Parameter Description
idrequired path · integer Subscriber id.

Open the full reference

Response 200 OK 
{
  "data": { "total": 340.00, "owed_to_me": 120.00 }
}
POST /api/v1/users/{id}/deposit Credit a subscriber wallet prm_users_deposit

Moves money into the subscriber's wallet and writes the matching ledger line. Idempotent on request_id through a unique constraint on the ledger itself, so the charge and the record of it cannot disagree.

Authentication
Staff token or session
Requires permission
prm_users_deposit Deposit to user wallet
Rate limit
t_mutate
Idempotency key
request_id

replay true means this exact request already happened and nothing moved this time. It is a success, and the balance shown is the one from the original operation.

Parameters

Parameter Description
idrequired path · integer Subscriber id.
amountrequired body · number Major units, a bare JSON number. 150.50, not "150.50" and not 15050.
request_idrequired body · string Idempotency key.
issue_invoice body · boolean Also record an invoice document. Skipped on a replay.

Open the full reference

Response 200 OK 
{
  "data": {
    "journal_id": 90412,
    "balance": 250.00,
    "debt": 0.00,
    "replay": false
  }
}
GET /api/v1/users/{id}/documents Manage user documents prm_users_documents
Authentication
Staff token or session
Requires permission
prm_users_documents Manage user documents

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/documents Manage user documents prm_users_documents
Authentication
Staff token or session
Requires permission
prm_users_documents Manage user documents
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/documents/bulk-delete Manage user documents prm_users_documents
Authentication
Staff token or session
Requires permission
prm_users_documents Manage user documents
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

DELETE /api/v1/users/{id}/documents/{docId} Manage user documents prm_users_documents
Authentication
Staff token or session
Requires permission
prm_users_documents Manage user documents
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

PATCH /api/v1/users/{id}/documents/{docId} Manage user documents prm_users_documents
Authentication
Staff token or session
Requires permission
prm_users_documents Manage user documents
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

GET /api/v1/users/{id}/documents/{docId}/download Manage user documents prm_users_documents
Authentication
Staff token or session
Requires permission
prm_users_documents Manage user documents

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/free-zone-traffic View free-zone traffic prm_users_freezone_traffic
Authentication
Staff token or session
Requires permission
prm_users_freezone_traffic View free-zone traffic
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

GET /api/v1/users/{id}/free-zones View free-zone traffic prm_users_freezone_traffic
Authentication
Staff token or session
Requires permission
prm_users_freezone_traffic View free-zone traffic

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

GET /api/v1/users/{id}/history View usage history prm_users_history
Authentication
Staff token or session
Requires permission
prm_users_history View usage history

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

GET /api/v1/users/{id}/invoices List one subscriber's invoices prm_users_invoices_view

Invoices belonging to a single subscriber, newest first.

Authentication
Staff token or session
Requires permission
prm_users_invoices_view View user invoices

Parameters

Parameter Description
idrequired path · integer Subscriber id.

Open the full reference

POST /api/v1/users/{id}/invoices Create an invoice for a subscriber prm_users_invoices_create

The per-subscriber form of issuing an invoice. Same validation and the same server-computed total; the subscriber comes from the path rather than the body.

Authentication
Staff token or session
Requires permission
prm_users_invoices_create Create user invoices
Rate limit
t_mutate

Parameters

Parameter Description
idrequired path · integer Subscriber id.
itemsrequired body · array At least one line item.

Open the full reference

POST /api/v1/users/{id}/invoices/bulk-pay Edit / pay user invoices prm_users_invoices_edit
Authentication
Staff token or session
Requires permission
prm_users_invoices_edit Edit / pay user invoices
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/invoices/bulk-unpay Edit / pay user invoices prm_users_invoices_edit
Authentication
Staff token or session
Requires permission
prm_users_invoices_edit Edit / pay user invoices
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

DELETE /api/v1/users/{id}/invoices/{invoiceId} Delete an invoice prm_users_invoices_delete

Deletes a hand-created invoice. Auto-issued documents cannot be deleted here, for the same reason they cannot be edited.

Authentication
Staff token or session
Requires permission
prm_users_invoices_delete Delete user invoices
Rate limit
t_mutate

Parameters

Parameter Description
idrequired path · integer Subscriber id.
invoiceIdrequired path · integer Invoice id.

Open the full reference

GET /api/v1/users/{id}/invoices/{invoiceId} Fetch one invoice prm_users_invoices_view

The invoice with its line items.

Authentication
Staff token or session
Requires permission
prm_users_invoices_view View user invoices

Parameters

Parameter Description
idrequired path · integer Subscriber id.
invoiceIdrequired path · integer Invoice id.

Open the full reference

PATCH /api/v1/users/{id}/invoices/{invoiceId} Edit an invoice prm_users_invoices_edit

Edits a hand-created invoice. Auto-issued documents — activations, extensions, add-ons, deposits and withdrawals — are not editable through this path.

Authentication
Staff token or session
Requires permission
prm_users_invoices_edit Edit / pay user invoices
Rate limit
t_mutate

Parameters

Parameter Description
idrequired path · integer Subscriber id.
invoiceIdrequired path · integer Invoice id.

Open the full reference

POST /api/v1/users/{id}/invoices/{invoiceId}/pay Mark an invoice paid prm_users_invoices_edit

Records the invoice as settled and stamps paid_on. This is bookkeeping: it does not move money between wallets.

Authentication
Staff token or session
Requires permission
prm_users_invoices_edit Edit / pay user invoices
Rate limit
t_mutate

Marking an invoice paid and taking a payment are different operations. This one changes a status; a deposit changes a balance. Doing one does not do the other.

Parameters

Parameter Description
idrequired path · integer Subscriber id.
invoiceIdrequired path · integer Invoice id.

Open the full reference

GET /api/v1/users/{id}/invoices/{invoiceId}/render-data View user invoices prm_users_invoices_view
Authentication
Staff token or session
Requires permission
prm_users_invoices_view View user invoices

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/invoices/{invoiceId}/unpay Mark an invoice unpaid prm_users_invoices_edit

Reverses the paid stamp. Again, bookkeeping only.

Authentication
Staff token or session
Requires permission
prm_users_invoices_edit Edit / pay user invoices
Rate limit
t_mutate

Parameters

Parameter Description
idrequired path · integer Subscriber id.
invoiceIdrequired path · integer Invoice id.

Open the full reference

GET /api/v1/users/{id}/journal View users prm_users_index
Authentication
Staff token or session
Requires permission
prm_users_index View users

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/login-as Log in as subscriber prm_users_login_as
Authentication
Staff token or session
Requires permission
prm_users_login_as Log in as subscriber
Rate limit
user_login_as

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/lookup-token/rotate Edit users prm_users_update
Authentication
Staff token or session
Requires permission
prm_users_update Edit users
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

GET /api/v1/users/{id}/parental Manage parental controls prm_users_parental
Authentication
Staff token or session
Requires permission
prm_users_parental Manage parental controls

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/parental/reset-pin Manage parental controls prm_users_parental
Authentication
Staff token or session
Requires permission
prm_users_parental Manage parental controls
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/pay-debt Withdraw / settle user debt prm_users_withdrawal
Authentication
Staff token or session
Requires permission
prm_users_withdrawal Withdraw / settle user debt
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

GET /api/v1/users/{id}/payments View users prm_users_index
Authentication
Staff token or session
Requires permission
prm_users_index View users

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

GET /api/v1/users/{id}/quota-buckets List a subscriber's quota buckets prm_users_index

Separately-metered grants layered on top of the plan's own quota — add-ons, extensions, card top-ups — in the order they will be drained.

Authentication
Staff token or session
Requires permission
prm_users_index View users

Un-paginated: the whole list is page 1 and has_next is always false. Do not write a paging loop against it. A subscriber may hold at most 50 active buckets, and a grant that would exceed the cap is refused before any money moves.

Parameters

Parameter Description
idrequired path · integer Subscriber id.

Open the full reference

Response 200 OK 
{
  "data": [
    {
      "id": 331,
      "source": "addon",
      "label": "Night 50GB",
      "priority": 10,
      "bytes_granted": 53687091200,
      "bytes_remaining": 41231686144,
      "seconds_granted": 0,
      "seconds_remaining": 0,
      "activated_at": "2026-09-12 20:04:01",
      "valid_until": "2026-10-12 20:04:01",
      "works_when_expired": false,
      "status": "active"
    }
  ],
  "meta": { "page": 1, "page_size": 1, "total": 1, "has_next": false }
}
POST /api/v1/users/{id}/quota-buckets/{bid}/cancel Manage quota buckets prm_users_buckets
Authentication
Staff token or session
Requires permission
prm_users_buckets Manage quota buckets
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

GET /api/v1/users/{id}/quota-history View usage history prm_users_history
Authentication
Staff token or session
Requires permission
prm_users_history View usage history

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

GET /api/v1/users/{id}/radius-attrs Manage user RADIUS attributes prm_users_radius_attributes
Authentication
Staff token or session
Requires permission
prm_users_radius_attributes Manage user RADIUS attributes

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/radius-attrs Manage user RADIUS attributes prm_users_radius_attributes
Authentication
Staff token or session
Requires permission
prm_users_radius_attributes Manage user RADIUS attributes
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/radius-attrs/bulk-delete Manage user RADIUS attributes prm_users_radius_attributes
Authentication
Staff token or session
Requires permission
prm_users_radius_attributes Manage user RADIUS attributes
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

DELETE /api/v1/users/{id}/radius-attrs/{attrId} Manage user RADIUS attributes prm_users_radius_attributes
Authentication
Staff token or session
Requires permission
prm_users_radius_attributes Manage user RADIUS attributes
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

PATCH /api/v1/users/{id}/radius-attrs/{attrId} Manage user RADIUS attributes prm_users_radius_attributes
Authentication
Staff token or session
Requires permission
prm_users_radius_attributes Manage user RADIUS attributes
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

GET /api/v1/users/{id}/receipts View users prm_users_index
Authentication
Staff token or session
Requires permission
prm_users_index View users

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/redeem-points Redeem reward points prm_users_reward_points
Authentication
Staff token or session
Requires permission
prm_users_reward_points Redeem reward points
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/refund-activation Refund last activation prm_users_refund
Authentication
Staff token or session
Requires permission
prm_users_refund Refund last activation
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/rename Rename users prm_users_rename
Authentication
Staff token or session
Requires permission
prm_users_rename Rename users
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/reset-password Edit users prm_users_update
Authentication
Staff token or session
Requires permission
prm_users_update Edit users
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/reset-quota Reset quota counters prm_users_reset_quota

Always zeroes the daily counters. With clear_period true it also nulls the period quota, which is the destructive form. Lifts a daily FUP throttle and kicks the live session so full speed returns immediately. An empty body is accepted and means clear_period false.

Authentication
Staff token or session
Requires permission
prm_users_reset_quota Reset user quota
Rate limit
t_mutate

Parameters

Parameter Description
idrequired path · integer Subscriber id.
clear_period body · boolean Also null the period quota counters. Defaults to false.
reason body · string Free-text note recorded on the quota-history audit row.

Open the full reference

GET /api/v1/users/{id}/sessions List a subscriber's session history prm_users_sessions_index

Accounting history for this subscriber, newest first, paginated with the standard list parameters.

Authentication
Staff token or session
Requires permission
prm_users_sessions_index View user sessions

Parameters

Parameter Description
idrequired path · integer Subscriber id.
filter[status] query · string Narrows to open or closed sessions.

Open the full reference

DELETE /api/v1/users/{id}/speed Edit users prm_users_update
Authentication
Staff token or session
Requires permission
prm_users_update Edit users
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

GET /api/v1/users/{id}/speed View users prm_users_index
Authentication
Staff token or session
Requires permission
prm_users_index View users

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

PUT /api/v1/users/{id}/speed Edit users prm_users_update
Authentication
Staff token or session
Requires permission
prm_users_update Edit users
Rate limit
t_mutate

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/suspend Suspend a subscriber prm_users_enable_disable

Sets enabled to false and, when the tenant has disconnect-on-update enabled, kicks any live session so the suspension takes effect now rather than at the next re-auth.

Authentication
Staff token or session
Requires permission
prm_users_enable_disable Enable / suspend users
Rate limit
t_mutate

Parameters

Parameter Description
idrequired path · integer Subscriber id.

Open the full reference

Response 200 OK 
{
  "data": {
    "id": 4711,
    "username": "ahmed",
    "enabled": false,
    "status": { "enabled": false, "can_connect": false }
  }
}
GET /api/v1/users/{id}/usage-history View usage history prm_users_history
Authentication
Staff token or session
Requires permission
prm_users_history View usage history

Read straight from the router that serves this instance. A hand-written description of this endpoint has not been added yet.

Open the full reference

POST /api/v1/users/{id}/withdraw Debit a subscriber wallet prm_users_withdrawal

The inverse of deposit. Refuses to take the balance below zero unless allow_negative is set.

Authentication
Staff token or session
Requires permission
prm_users_withdrawal Withdraw / settle user debt
Rate limit
t_mutate
Idempotency key
request_id

Parameters

Parameter Description
idrequired path · integer Subscriber id.
amountrequired body · number Major units.
request_idrequired body · string Idempotency key.
allow_negative body · boolean Permit the withdrawal to drive the balance below zero.

Open the full reference

Written to be read by machines too

The reference is public and needs no account, so a tool that has never seen X-Radius can reach a correct first call on its own.

/llms.txt
An index of every page, with one-line summaries.
/llms-full.txt
The whole reference as one Markdown file, with no navigation to crawl.
/openapi.json
OpenAPI 3.1, generated from the router that serves this instance.
/skill.md
A ready-made skill file for an assistant: authentication, the response envelope and the error codes in one page.
<page-url>.md
Append .md to any reference URL for the same page as Markdown.
Accept: text/markdown
Send this header on the ordinary URL and the answer comes back as Markdown instead.
Hand this to your assistant 
Read https://x-radius.com/llms.txt, then fetch the endpoint you need as Markdown by appending .md to its URL.

Try it on your own network.

50 subscribers for 7 days. You pay nothing.

Try it free Talk to us